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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
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Status 

1)E3 Responsive to communication(s) filed on 10 January 2008 . 
2a)D This action is FINAL. 2b)E] This action is non-final. 
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4) 03 Claim(s) 30-38 is/are pending in the application. 
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5) Q Claim(s) is/are allowed. 
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8) D Claim(s) are subject to restriction and/or election requirement. 
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Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
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DETAILED ACTION 

1. Claims 30-38 are ' pending . 

2. After Final response filed 01/10/2008 has been received and 
fully considered. Prosecution is hereby reopened. 

Claim Rejections - 35 USC §101 

3. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, 
manufacture, or composition of matter, or any new and useful improvement 
thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

Claims 30-38 are rejected under 35 U.S.C. 101 because the 
claimed invention is directed to non-statutory subject matter. 
Claims 30-38 relate to a system however this system fails to 
positively recite any actual hardware to constitute a system. 
Additionally the specification (see abstract) states the system 
can be software and/or hardware, therefore the system can be 
merely software. The claims lack the necessary physical 
articles or objects to constitute a machine or a manufacture 
within the mean of 35 USC §101. They are clearly not a series 
of steps or acts to be a process not are they a combination of 
chemical compounds to be a composition of matter. As such, they 
fail to fall within a statutory category. They are, at best, 
functional descriptive material per se. 
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Claim Rejections - 35 USC §103 

4. The text of those sections of Title 35, U.S. Code not 
included in this action can be found in a prior Office action. 

5. Claims 30-38 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Boroughs et al. (US 6834350) in view of 
Fujiyama et al. (US 6971026). 

As per claims 30 and 33, Boroughs et al. discloses a 
security system comprising: an activation token identifying 
system characteristics and specifying a threat and at least one 
preset activation measure, wherein a system characteristic is 
one of the group of a hardware system, a service, a 
configuration of a service, a service execution platform, and a 
service session (see column 2 line 62 through column 3 line 34); 
a first system configured to at least review security and 
vulnerability information form information publishers and to 
provide the activation token based on filtered security and 
vulnerability information (see column 2 line 59 through column 3 
line 10); and a second system configured to determine whether 
the activation token is relevant by checking if actual 
characteristics at the second system correspond to the system 
characteristics identified by the activation token, the second 
system further configured to transform the activation token into 
at least one activation measure if the activation token is 
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considered relevant by the second system the activation measure 
configured to modify services executing at the second system 
(see column 3 lines 35-67 and column 4 lines 1-5) wherein the 
first system is further configured to automatically filter the 
security and vulnerability information relevant to the system 
characteristics identified by the activation token (see column 2 
line 59 through column 3 line 10 and Figure 17). 

Boroughs et al. fail to explicitly disclose including a 
threat level within the activation token. 

However, Fujiyama et al. teaches including a trust level 
with an activation token (see figures 2-5 and column 7 line 54 
through column 8 line 55) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to include trust levels 
with the activation tokens of Boroughs et al. 

Motivation to do so would have been to distinguish between 
the types of threats (see figures 2-5 and column 7 line 54 
through column 8 line 55) . 

As per claim 31, the modified Boroughs et al. and Fujiyama 
et al. system discloses cryptographic means configured to verify 
at the second system that the first system is a trusted service 
(see Boroughs et al. column 3 lines 55-67). 
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As per claim 32, the modified Boroughs et al. and Fujiyama 
et al. system discloses reporting means configured to report to 
a system administrator of the second system any activation 
measure taken by the second system (see Boroughs et al. column 2 
lines 59-67) . 

As per claim 34, the modified Boroughs et al . and Fujiyama 
et al. system discloses a list of trusted service providers from 
whom activation tokens are accepted by the second system (see 
Fujiyama et al. column 8 lines 13-39). 

As per claims 35 and 36, the modified Boroughs et al. and 
Fujiyama et al. system discloses a preset activation measure is 
one of shutting down a service affected by the specified threat 
level and reconfiguration of the service (see Fujiyama et al . 
Figure 3 column 202). 

As per claim 38, the modified Boroughs et al . and Fujiyama 
et al . system fails to explicitly disclose that the at least one 
preset activation measure is alerting a system administrator. 

However, Official Notice is taken that at the time of the 
invention it would have been obvious to alert a system 
administrator. 

Motivation to do so would have been so that the system 
administrator knows to take action. 
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6. Claim 37 is rejected under 35 U.S.C. 103(a) as being 
unpatentable over the modified Boroughs et al. and Fujiyama et 
al. system as applied to claim 30 above, and further in view of 
Pearson (US 6990591)'. 

As per claim 37, the modified Boroughs et al. and Fujiyama 
et al. system fails to explicitly disclose installing a patch as 
an activation measure. 

However, Pearson teaches installing a patch (see column 13 
lines 4-15) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to install a patch as one 
of the activation measures of the modified Boroughs et al. and 
Fujiyama et al. system. 

Motivation to do so would have been to update the attack 
signature list (see Pearson column 13 lines 4-15).. 

Response to Arguments 

7. Applicant's arguments, filed 01/10/2008, with respect to 
the rejection(s) of claim(s) 30-38 under 35 USC 103(a) over the 
modified Boroughs et al. and Riordan et al . system have been 
fully considered and are persuasive. Therefore, the rejection 
has been withdrawn. However, upon further consideration, a new 
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ground(s) of rejection is made in view of the modified Boroughs 
et.al. and Fujiyama et al . system. 

Conclusion 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 

If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
571-273-8300. 
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Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . If you would 
like assistance from a USPTO Customer Service Representative or 
access to the automated information system, call 800-786-9199 
(IN USA OR CANADA) or 571-272-1000. 
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